Notices
Series I Aftermarket Performance Modifications Discussion of power adding modifications

cracking the ecu....

Thread Tools
 
Search this Thread
 
Rate Thread
 
Old 03-25-2006, 12:18 PM
  #181  
Is this title ok?
 
seikx8's Avatar
 
Join Date: Jan 2003
Location: El Monte, CA
Posts: 300
Likes: 0
Received 2 Likes on 2 Posts
The attached is some new finding.
Attached Files
File Type: zip
sw-n3z2ep000.map.zip (26.8 KB, 402 views)
seikx8 is offline  
Old 03-25-2006, 12:30 PM
  #182  
Is this title ok?
 
seikx8's Avatar
 
Join Date: Jan 2003
Location: El Monte, CA
Posts: 300
Likes: 0
Received 2 Likes on 2 Posts
There is a connector left out in the circuit board. This should be a communication port for EPROM programming by connecting a jumper. ROM contents may be download and examine and can be put back the same way. This is the easiest way to do without having to deal with other limitation that the ECM re-programming module might have via the CAN network. But accessing to those software and tools are currently attainable only by professional according to my current knowledge.

Originally Posted by StealthTL
Looks like just a port, for communicating with the board.

S
seikx8 is offline  
Old 03-25-2006, 12:40 PM
  #183  
Is this title ok?
 
seikx8's Avatar
 
Join Date: Jan 2003
Location: El Monte, CA
Posts: 300
Likes: 0
Received 2 Likes on 2 Posts
Once the main map is modified, the LTF will not be a problem. Base on what I see, there seemed to be some value reside close to the each map area that have some indication of its expected values; if not, they might as well be checksum bytes.

Originally Posted by Hskr8
back to the original idea, I wonder if they are tuning the complete car maps, or just the long term ones or both?

part of the reason the cz unit became problematic was because the long term maps would eventually defeat the tuning... so in converse, theory suggests if we could identify the long term section and modify that and flash it, the car would eventually steer towards the those long term values.
seikx8 is offline  
Old 04-04-2006, 12:23 PM
  #184  
Bullshit Detector
 
RX3+5's Avatar
 
Join Date: Oct 2004
Location: Auburn, CA
Posts: 272
Likes: 0
Received 0 Likes on 0 Posts
Any news?

Vince
RX3+5 is offline  
Old 04-04-2006, 11:43 PM
  #185  
No respecter of malarkey
iTrader: (25)
 
TeamRX8's Avatar
 
Join Date: Apr 2005
Posts: 26,742
Received 2,023 Likes on 1,648 Posts
The Borg Project is progressing ...
TeamRX8 is offline  
Old 04-04-2006, 11:53 PM
  #186  
Registered User
Thread Starter
iTrader: (1)
 
Hskr8's Avatar
 
Join Date: Dec 2003
Location: Nebraska
Posts: 310
Likes: 0
Received 0 Likes on 0 Posts
I think the only way to go forward is to take an educated guess at a certain data spot, make a noticable change at a certain rpm data point... something out of the norm, figure a way to re-introduce the checksum to the file, flash the car, and compare to a stock set of logged data to identify what actually changed.

With this kind of hunt and peck approach it would take a little while at first, but could be doable. I would need to get the right tools to do this too. Of course having the software emulator like was shown in those video screen shots would make things allot easier and faster.
Hskr8 is offline  
Old 04-05-2006, 04:07 AM
  #187  
Registered
 
Rasputin's Avatar
 
Join Date: Sep 2004
Location: Europe
Posts: 581
Likes: 0
Received 0 Likes on 0 Posts
seikx8,

I had a proper look at your file yesterday night. I have a few comments.

I don't think what you identifed in a previous post as a spark advance table actually is one.
I found these two tables to be more in line with what to expect :

X-Axis: [0x7fc78 9x4]
0.125 0.2 0.25 0.3125 0.375 0.4375 0.5 0.5625 0.625
Y-Axis: [0x7fc9c 9x4]
500 1000 1400 2000 2500 3000 3500 4000 4500
Cells: [0x7fcc0 9x9x4]
16.68 16.68 18.00 17.27 21.41 18.22 16.62 17.08 16.05
16.68 16.68 18.00 17.27 21.41 18.22 16.62 17.08 16.05
16.68 16.68 18.00 17.27 21.41 18.22 16.62 17.08 16.05
17.82 17.82 19.80 17.06 16.95 16.84 19.38 17.02 15.66
17.53 17.53 16.08 15.26 18.31 17.07 16.04 20.04 17.76
17.59 17.59 22.59 18.83 16.38 18.67 18.12 18.86 17.97
18.06 18.06 25.14 18.45 18.89 17.67 21.62 21.62 21.62
19.36 19.36 22.95 18.71 18.13 18.55 20.17 20.17 20.17
19.36 19.36 22.95 18.71 18.13 18.55 20.17 20.17 20.17

X-Axis: [0x7fe10 10x4]
0.16 0.21 0.25 0.375 0.5 0.625 0.75 0.875 1 1.1
Y-Axis: [0x7fe38 17x4]
780 1000 1500 2000 2500 3000 3500 4000 4500 5000 5500 6000 6500 7000 7500 8000 8500
Cells: [0x7fe7c 10x17x4]
21.80 21.80 21.80 43.10 56.90 73.90 79.70 79.70 79.70 79.70
15.87 15.87 22.60 43.10 56.90 73.90 79.70 79.70 79.70 79.70
16.00 18.30 20.10 31.90 43.50 55.20 66.70 66.70 66.70 66.70
10.40 13.51 16.00 24.10 32.40 42.60 50.70 57.20 57.20 57.20
9.00 10.77 12.20 18.40 24.20 30.00 38.10 44.90 44.90 44.90
7.00 9.17 10.90 16.40 21.20 28.00 33.80 41.40 41.40 41.40
5.50 7.45 9.00 14.50 20.10 25.70 31.70 36.80 36.80 36.80
5.50 6.84 7.90 12.60 17.40 22.90 26.70 29.00 29.00 29.00
5.00 5.89 6.60 11.50 15.60 20.30 23.50 27.90 27.90 27.90
6.00 6.00 6.00 10.00 13.80 18.70 22.40 23.50 23.60 23.60
6.00 6.00 6.00 9.30 12.00 15.90 19.70 20.00 20.10 20.10
6.00 6.00 6.00 7.60 9.90 12.90 16.60 18.40 19.50 19.50
6.00 6.00 6.00 6.00 9.10 11.80 13.30 13.91 16.10 16.10
6.00 6.00 6.00 6.00 9.80 11.50 13.30 16.41 16.17 16.17
13.00 13.00 13.00 13.00 10.79 11.80 15.00 16.90 20.20 20.20
13.00 13.00 13.00 13.00 13.00 13.00 18.00 22.00 30.00 30.00
14.00 14.00 14.00 14.00 14.00 14.00 22.00 31.00 31.00 31.00

One must be for Leading, and the other one for Trailing plugs. Please feel free to comment.
This can be verified easily with a sCANalyser.

I also think these following 2 tables gives the range of authority (retard/advance clips) for the knock control :

X-Axis: [0x7dca8 20x4]
0.0625 0.125 0.1875 0.25 0.3125 0.375 0.4375 0.5 0.5625 0.625 0.6875 0.75 0.8125 0.875 0.9375 1 1.0625 1.125 1.1875 1.25
Y-Axis: [0x7dcf8 12x4]
500 1000 1500 2000 2500 3000 3500 4000 4500 5000 5500 6000
Cells: [0x7dd28 20x12x4]
2.20 2.20 2.20 2.20 2.20 2.20 2.20 2.20 2.20 2.50 2.50 2.50 2.50 2.50 2.50 2.50 2.50 2.50 2.50 2.50
2.20 2.20 2.20 2.20 2.20 2.20 2.20 2.20 2.20 2.50 2.50 2.50 2.50 2.50 2.50 2.50 2.50 2.50 2.50 2.50
2.30 2.30 2.30 2.30 2.30 2.30 2.30 2.30 2.30 2.30 2.30 2.30 2.30 2.30 2.30 2.30 2.30 2.30 2.30 2.30
2.40 2.40 2.40 2.40 2.40 2.40 2.40 2.40 2.40 2.40 2.40 2.40 2.40 2.40 2.40 2.40 2.40 2.40 2.40 2.40
2.80 2.80 2.80 2.80 2.80 2.80 2.80 2.80 2.80 2.80 2.80 2.80 2.80 2.80 2.80 2.80 2.80 2.80 2.80 2.80
2.60 2.60 2.60 2.60 2.60 2.60 2.60 2.60 2.60 2.60 2.60 2.60 2.60 2.90 2.90 2.90 2.90 2.90 2.90 2.90
3.00 3.00 3.00 3.00 3.00 3.00 3.00 3.00 3.00 3.00 3.00 3.00 2.80 2.80 2.80 2.80 2.80 2.80 2.80 2.80
3.00 3.00 3.00 3.00 3.00 3.00 3.00 3.00 3.00 3.00 3.00 3.00 3.00 3.00 3.00 3.00 3.00 3.00 3.00 3.00
2.80 2.80 2.80 2.80 2.80 2.80 2.80 2.80 2.80 2.80 2.80 2.80 2.80 2.80 2.80 2.80 2.80 2.80 2.80 2.80
2.75 2.75 2.75 2.75 2.75 2.75 2.75 2.75 2.75 2.75 2.75 2.75 2.75 2.75 2.75 2.75 2.75 2.75 2.75 2.75
2.75 2.75 2.75 2.75 2.75 2.75 2.75 2.75 2.75 2.75 2.75 2.75 2.75 2.75 2.75 2.75 2.75 2.75 2.75 2.75
2.75 2.75 2.75 2.75 2.75 2.75 2.75 2.75 2.75 2.75 2.75 2.75 2.75 2.75 2.75 2.75 2.75 2.75 2.75 2.75

X-Axis: [0x7e0f4 20x4]
0.0625 0.125 0.1875 0.25 0.3125 0.375 0.4375 0.5 0.5625 0.625 0.6875 0.75 0.8125 0.875 0.9375 1 1.0625 1.125 1.1875 1.25
Y-Axis: [0x7e144 12x4]
500 1000 1500 2000 2500 3000 3500 4000 4500 5000 5500 6000
Cells: [0x7e174 20x12x4]
2.30 2.30 2.30 2.30 2.30 2.30 2.30 2.30 2.30 2.50 2.50 2.50 2.50 2.50 2.50 2.50 2.50 2.50 2.50 2.50
2.30 2.30 2.30 2.30 2.30 2.30 2.30 2.30 2.30 2.50 2.50 2.50 2.50 2.50 2.50 2.50 2.50 2.50 2.50 2.50
3.20 3.20 3.20 3.20 3.20 3.20 3.20 3.20 3.20 3.20 3.20 3.20 3.20 3.20 3.20 3.20 3.20 3.20 3.20 3.20
3.00 3.00 3.00 3.00 3.00 3.00 3.00 3.00 3.00 3.00 3.00 3.00 3.00 3.00 3.00 3.00 3.00 3.00 3.00 3.00
3.30 3.30 3.30 3.30 3.30 3.30 3.30 3.30 3.30 3.30 3.30 3.30 3.30 3.30 3.30 3.30 3.30 3.30 3.30 3.30
3.60 3.60 3.60 3.60 3.60 3.60 3.60 3.60 3.60 3.60 3.60 3.60 3.60 3.80 3.80 3.80 3.80 3.80 3.80 3.80
3.90 3.90 3.90 3.90 3.90 3.90 3.90 3.90 3.90 3.90 3.90 3.90 4.00 4.00 4.00 4.00 4.00 4.00 4.00 4.00
4.00 4.00 4.00 4.00 4.00 4.00 4.00 4.00 4.00 4.00 4.00 4.00 4.00 4.00 4.00 4.00 4.00 4.00 4.00 4.00
3.90 3.90 3.90 3.90 3.90 3.90 3.90 3.90 3.90 3.90 3.90 3.90 3.90 3.90 3.90 3.90 3.90 3.90 3.90 3.90
3.75 3.75 3.75 3.75 3.75 3.75 3.75 3.75 3.75 3.75 3.75 3.75 3.75 3.75 3.75 3.75 3.75 3.75 3.75 3.75
3.75 3.75 3.75 3.75 3.75 3.75 3.75 3.75 3.75 3.75 3.75 3.75 3.75 3.75 3.75 3.75 3.75 3.75 3.75 3.75
3.75 3.75 3.75 3.75 3.75 3.75 3.75 3.75 3.75 3.75 3.75 3.75 3.75 3.75 3.75 3.75 3.75 3.75 3.75 3.75

Again, this can easily be checked.


Regarding the table identified as the fuel table, I don't believe it is the main fuel table (however, it can be a default fuel pulsewidth table in case of MAFS failure for example). Fuelling usually works this way on OEM products :
1) The quantity of air induced in the next stroke is estimated by a very complex dedicated strategy module that will basically also calculate a LOAD value. On the RX8, this estimation is essentially based on MAFS data.
2) The PCM then calculates the amount of fuel that's necessary to achieve the target lambda value (whether it is in open loop or close loop does not change this) . It derives a fuel pulsewidth from this amount of fuel.

You see, no base fuel maps with fuel pulsewidth in such a system. The only "fuel" tables actually define where the system works in open or closed loop, and the target lambda value.
Another point that could confirm this is the fact we only find one table that really looks like a fuel injector pulsewidth table (up to 28000). But we have three levels of injectors with independant fuelling patterns. We should therefore have 3 tables and 2 of them with "0" pulse width under 4000 RPM (SSV is closed).

So, what we're looking for, in order to modify fuelling is :
- an open / closed loop table : LOAD (or possibly a TPS-derived load input) vs N 'engine speed) with 0s and 1s in the table
- another LOAD vs N table with target lambdas in it. There will be a wide area at low/medium speeds and loads where lambda is 1.
- somewhere, there must be a fuction or table giving info to the system regarding the share of the scheduled fuelling between the 3 levels of injection.

Modifying fuelling for FI :
To calculate the engine air consumption, the engine essentually use MAFS data.
To estimate the fuel pulse width, the system uses a complex algorithm introducing all sorts of data, including injector related info.
The PCM is actually capable of adjusting by it self the fuelling based on the existing maps, but it will somewhere be limted by the system's diagnostic fucntions (whether they are a legal requirement - like OBD - or not). I can immediatelly identify 2 of them :
- a first one that compares at all times the measured mass air flow for a given TPS and engine speed to a inferred (= calculated + mapped) load value. If the difference is too high (due to FI for example) -> CEL & Limp Home...
- a second one has been extensively mentionned on this forum, it's the LTFuelTrim, or adaptive fuelling that is also limited (+/- 12.5 % if I remember correctly). Go above the limit and it's CEL and possibly Limp Home...

Fabrice

Last edited by Rasputin; 04-05-2006 at 04:10 AM.
Rasputin is offline  
Old 04-05-2006, 05:25 AM
  #188  
Registered User
 
tertou's Avatar
 
Join Date: Apr 2004
Location: Belgium
Posts: 55
Likes: 0
Received 0 Likes on 0 Posts
Thanks for these enlightenments, Fabrice.
tertou is offline  
Old 04-05-2006, 05:33 AM
  #189  
Registered
 
Rasputin's Avatar
 
Join Date: Sep 2004
Location: Europe
Posts: 581
Likes: 0
Received 0 Likes on 0 Posts
Originally Posted by tertou
Thanks for these enlightenments, Fabrice.
C'est toujours un plaisir, Thierry.
Rasputin is offline  
Old 04-05-2006, 10:46 PM
  #190  
Registered User
iTrader: (1)
 
rxtreme's Avatar
 
Join Date: Jul 2002
Location: NY
Posts: 347
Likes: 0
Received 0 Likes on 0 Posts
- a first one that compares at all times the measured mass air flow for a given TPS and engine speed to a inferred (= calculated + mapped) load value. If the difference is too high (due to FI for example) -> CEL & Limp Home...
- a second one has been extensively mentionned on this forum, it's the LTFuelTrim, or adaptive fuelling that is also limited (+/- 12.5 % if I remember correctly). Go above the limit and it's CEL and possibly Limp Home...
So given this information, is it possible to determine how far FI (i.e. how much boost) can be applied with the stock ECU? Could RP use the stock ECU for his axialflow application?
rxtreme is offline  
Old 04-05-2006, 11:39 PM
  #191  
Administrator
 
zoom44's Avatar
 
Join Date: Jul 2002
Location: portland oregon
Posts: 21,958
Received 115 Likes on 88 Posts
no RPs axial flow unit will run out of fuel with the stock maps.
zoom44 is offline  
Old 04-06-2006, 10:43 AM
  #192  
Registered User
iTrader: (1)
 
rxtreme's Avatar
 
Join Date: Jul 2002
Location: NY
Posts: 347
Likes: 0
Received 0 Likes on 0 Posts
I am not talking about stock maps, I am trying to say can the stock ECU be modified enough (i.e. reflashed) to meet the needs of some FI requirements and what are those limits?
rxtreme is offline  
Old 04-06-2006, 12:10 PM
  #193  
No respecter of malarkey
iTrader: (25)
 
TeamRX8's Avatar
 
Join Date: Apr 2005
Posts: 26,742
Received 2,023 Likes on 1,648 Posts
it's a lot easier to hijack the system with either an internal or external piggyback controller

even if you get the maps figured out and how to alter them, figuring out the base code programming functions that determine the overall software control strategy is a much more difficult task.

Last edited by TeamRX8; 04-06-2006 at 12:13 PM.
TeamRX8 is offline  
Old 04-06-2006, 01:17 PM
  #194  
Administrator
 
zoom44's Avatar
 
Join Date: Jul 2002
Location: portland oregon
Posts: 21,958
Received 115 Likes on 88 Posts
oh um yeah the limit is the stock fuel delivery . which i believe is enough for slightly over 300whp. more if you go with a complete set of the bigger "blue" injectors, maybe 350 whp(thats a guess i havent done the math.).
zoom44 is offline  
Old 04-07-2006, 11:53 AM
  #195  
Registered User
iTrader: (1)
 
rxtreme's Avatar
 
Join Date: Jul 2002
Location: NY
Posts: 347
Likes: 0
Received 0 Likes on 0 Posts
300-350 WHP would not be bad with the stock ECU. Which, I believe, might be good enough for RP's application. All of you obviously know the advantages to using the stock ECU over anything available to date - even the Interceptor-X: no loss of auxillary functions (DSC, cruise, ABS, etc.), ability to keep a clean and stock appearance, and most likely cost. I really hope someone can crack the code. Can't anybody help us out as a dealership? Maybe get a loaner WDS? :P
rxtreme is offline  


You have already rated this thread Rating: Thread Rating: 0 votes,  average.

Quick Reply: cracking the ecu....



All times are GMT -5. The time now is 11:06 PM.